I’m thinking this is likely a linux configuration thing versus an osquery thing.